Contents
V5631. OWASP. Use of externally-controlled format string. Potentially tainted data is used as a format string.
The analyzer has detected the use of an externally-controlled format string without prior validation. If the number of placeholders in the format string does not match the number of arguments, this results in either an exception being thrown or information being lost.
The example:
static void Foo(string hostName, int port, params string[] args)
{
using (TcpClient tcpConn = new TcpClient(hostName, port))
{
using (StreamReader sr = new StreamReader(tcpConn.GetStream()))
{
var format = sr.ReadLine();
var data = ApplyFormat(format, args);
....
}
}
}
static string ApplyFormat(string format, string[] args)
{
return string.Format(...., format, args);
}In the example, the format value is externally retrieved and passed to ApplyFormat, where it is directly used as the format in the string.Format method. Since no validation is performed on the number of the placeholders ({....}) in the string, there is a risk of mismatch with the arguments in args. If the number of placeholders is less, some arguments will be ignored. If it is greater, an exception will be thrown.
To avoid potential problems, validate the format string before use, for example, with a regular expression:
static bool TryApplyFormat(string format, string[] args, out string[] data)
{
if (Regex.Matches(format, ....).Count == args.Length)
{
data = string.Format(format, args);
return true;
}
data = null;
return false;
}This diagnostic is classified as:
|
Was this page helpful?
